high
advisory
NoNonsense Notes: Insecure permissions in NotificationHelper (CVE-2026-107037)
Insecure permissions in the NotificationHelper component of NoNonsense Notes versionCode 72600 allow unauthorized attackers to write in another user's notes via supplying a note id.
CVE search metadata
CVE search record: CVE-2026-107037. Severity: high. CVSS: 7.5. KEV: no. Product: NoNonsense Notes (versionCode 72600). Brief: NoNonsense Notes: Insecure permissions in NotificationHelper (CVE-2026-107037). Brief link: https://feed.craftedsignal.io/briefs/2026-10-nononsense-notes-insecure-permissions/
Triage facts
Revision 1- Applicability
- NoNonsense Notes (versionCode 72600)
- Evidence
- Unknown
- Severity
- High
- Sources
- 1 public source
- Freshness
- Revision 1Oct 29, 23:08 UTC
- Vulnerabilities
- 1 CVE
- Source quality
- A2Roughly even chance
The NotificationHelper component of NoNonsense Notes versionCode 72600 contains an insecure permissions vulnerability. This allows unauthorized attackers to write in another user's notes by supplying a note id.